> once the attacker has gained root rights on the machine

... he/she/it can create an account, install programs, insert kernel drivers, modify the bootloader, compile a new kernel and so on and so forth